Dependency-Check Report

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\bin\commons-daemon.jar
MD5: bb27d960ade50ef134ce1009399014c3
SHA1: a3af8109d05090664542b1eba2549108cb56479f
SHA256:e9469231d2f1e2e5a5c676ca9acb0012b6a4be3f8d7ca1884aae5dfe23beca65
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	daemon	Highest
Vendor	Manifest	implementation-build	UNKNOWN_BRANCH@r??????; 2019-09-30 15:56:17+0000	Low
Vendor	pom	groupid	commons-daemon	Highest
Vendor	file	name	commons-daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	jar	package name	apache	Highest
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Vendor	jar	package name	commons	Highest
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	jar	package name	support	Highest
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	pom	name	Apache Commons Daemon	High
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	pom	artifactid	commons-daemon	Low
Product	jar	package name	daemon	Highest
Product	Manifest	implementation-build	UNKNOWN_BRANCH@r??????; 2019-09-30 15:56:17+0000	Low
Product	file	name	commons-daemon	High
Product	pom	groupid	commons-daemon	Low
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	support	Highest
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Low
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	pom	name	Apache Commons Daemon	High
Product	Manifest	build-jdk-spec	1.8	Low
Product	pom	artifactid	commons-daemon	Highest
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Implementation-Version	1.2.2	High
Version	Manifest	Bundle-Version	1.2.2	High
Version	pom	version	1.2.2	Highest
Version	pom	parent-version	1.2.2	Low

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.2.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\bin\tomcat-juli.jar
MD5: 1ac55312af0bab57f7b272f96b20e2a2
SHA1: 7f095b3bcde2472c5284a279a5c0874a5504ae77
SHA256:30341dcf832143f0281e80eaadd566add8446f49212bdae160d78e955fa6a23c
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	jar	package name	juli	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	jar	package name	apache	Highest
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	jar	package name	juli	Low
Vendor	Manifest	dstamp	20200403	Low
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	today	April 3 2020	Low
Product	jar	package name	juli	Highest
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	jar	package name	apache	Highest
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	juli	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	Manifest	dstamp	20200403	Low
Product	Manifest	tstamp	1302	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	file	name	tomcat-juli	High
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	Implementation-Version	9.0.34	High
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\annotations-api.jar
MD5: 8cda64e6d543ec457da9592a8582582a
SHA1: 3e6e7ce901cce8d17d561763e032f44e78d6ecc9
SHA256:8934511bc30f08f21925d8a133ea8da720505dce560991b0447e6d829dfe631e
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	today	April 3 2020	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	jar	package name	annotation	Low
Vendor	file	name	annotations-api	High
Vendor	jar	package name	javax	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	Manifest	dstamp	20200403	Low
Product	Manifest	today	April 3 2020	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	annotation	Low
Product	file	name	annotations-api	High
Product	Manifest	dstamp	20200403	Low
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	tstamp	1302	Low
Product	jar	package name	annotation	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\catalina-ant.jar
MD5: 3c3bfe042387bfd9ce40b69cb2767f2d
SHA1: 2cfd9a27d08f9b6c93378ab6d7ef4440834566a2
SHA256:fcd5d894771f80b3081f97e60ce83ca48e8bb5b8b00b059e52ff47a90f047dbf
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	catalina	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	jar	package name	catalina	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.34	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:High)

Published Vulnerabilities

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\catalina-ha.jar
MD5: 3e377209932b4e0c72be9053600d95ce
SHA1: 930f0ef9b5a93107dd7e934eb67ff23505ef90f1
SHA256:31015cf960b1ba4c67c9172e220a3b4593824b66afcf786d098b79e40555ef1a
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	catalina	Highest
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	jar	package name	ha	Highest
Vendor	Manifest	dstamp	20200403	Low
Vendor	Manifest	tstamp	1302	Low
Vendor	jar	package name	ha	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	jar	package name	apache	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	jar	package name	catalina	Low
Product	jar	package name	catalina	Highest
Product	Manifest	today	April 3 2020	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	jar	package name	ha	Highest
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	Manifest	dstamp	20200403	Low
Product	Manifest	tstamp	1302	Low
Product	jar	package name	ha	Low
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	Implementation-Version	9.0.34	High
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\catalina.jar
MD5: e4800fe5fbb194f94341eaf7d76c7aa2
SHA1: 7574087f119d9dedc307a0d8c8025de130f1ec97
SHA256:ca91441f029e6b420702fec59334340851e096bca7956c7d58589e43afc58afb
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	catalina	Highest
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	Manifest	dstamp	20200403	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	jar	package name	catalina	Low
Product	jar	package name	catalina	Highest
Product	Manifest	today	April 3 2020	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	Manifest	dstamp	20200403	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	tstamp	1302	Low
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	jar	package name	tomcat	Highest
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	Implementation-Version	9.0.34	High
Version	Manifest	today	3	Low
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\ecj-4.15.jar
MD5: 4d1404f81be38fdf9186c9556c4ad3e9
SHA1: d06974eec06892e5594bdb8fbbc95cd81f1c57b2
SHA256:9082211f48782750093f07822d1ae481e8ece250449578f372334da626ccdead
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	core	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	eclipse	Low
Vendor	file	name	ecj	High
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Vendor	jar	package name	internal	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	jar	package name	core	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	jar	package name	compiler	Highest
Product	jar	package name	jdt	Highest
Product	file	name	ecj	High
Product	jar	package name	eclipse	Highest
Product	jar	package name	jdt	Low
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	jar	package name	internal	Low
Product	jar	package name	compiler	Low
Version	file	version	4.15	Highest
Version	file	name	ecj	Medium
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.21.0.v20200304-1404	High

Identifiers

None

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\el-api.jar
MD5: 0bdcfaf588eda7a79baf6fc9706533da
SHA1: 8ac6dae31e12e7577657d3b9c19332bd4eb6f2a5
SHA256:d590c6b1fbd19a8a5563f96fa596f26b452f51e69c477b70e7f0c622f390cc43
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	el	Highest
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	jar	package name	el	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	file	name	el-api	High
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	dstamp	20200403	Low
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	Manifest	today	April 3 2020	Low
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	expression	Highest
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	dstamp	20200403	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	file	name	el-api	High
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Product	Manifest	tstamp	1302	Low
Product	jar	package name	javax	Highest
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\jasper.jar
MD5: 43f43e0b49b75b248d0abd28e3bd5139
SHA1: 3b3c09fecacded52cd599a1ea6565211047a3c95
SHA256:fcc87b357245a756d78e6a4310e2c9a852ada52983796d3510cb86e72cfba19a
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	jar	package name	apache	Highest
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	dstamp	20200403	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Low
Vendor	file	name	jasper	High
Vendor	jar	package name	jasper	Highest
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	jar	package name	apache	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	today	April 3 2020	Low
Product	jar	package name	apache	Highest
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	Manifest	dstamp	20200403	Low
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Low
Product	file	name	jasper	High
Product	jar	package name	jasper	Highest
Product	Manifest	tstamp	1302	Low
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	Implementation-Version	9.0.34	High
Version	Manifest	today	3	Low
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\jaspic-api.jar
MD5: 204813c4caf6bd514a5e3758f47ec8c2
SHA1: ddf913a3aa40099fee5c67b3741eb2a1738f8bc5
SHA256:3f9539bc6df18784e82778fe6df9c7e5a359627da6bb2b0a5d030eef9d3d3ae5
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	today	April 3 2020	Low
Vendor	file	name	jaspic-api	High
Vendor	Manifest	tstamp	1302	Low
Vendor	jar	package name	security	Low
Vendor	jar	package name	auth	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	manifest: javax/security/auth/message	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	jar	package name	javax	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	Manifest	dstamp	20200403	Low
Product	jar	package name	auth	Highest
Product	Manifest	today	April 3 2020	Low
Product	manifest: javax/security/auth/message	Specification-Title	Java Authentication SPI for Containers	Medium
Product	file	name	jaspic-api	High
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	jar	package name	auth	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	manifest: javax/security/auth/message	Implementation-Title	javax.security.auth.message	Medium
Product	Manifest	dstamp	20200403	Low
Product	jar	package name	security	Highest
Product	jar	package name	message	Low
Product	jar	package name	message	Highest
Product	Manifest	tstamp	1302	Low
Product	jar	package name	security	Low
Product	jar	package name	javax	Highest
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	manifest: javax/security/auth/message	Implementation-Version	1.1.FR	Medium
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\jsp-api.jar
MD5: 0f5b59d65f7b50329c49f09c31324a7b
SHA1: 1da099f7517a5ce18328b3c07d8d1e99d0cca8c4
SHA256:2a476939d80a1120197557ea48d4cf761d7bd99e65fb0870649e6285d93ca694
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	today	April 3 2020	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	jar	package name	jsp	Low
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	dstamp	20200403	Low
Vendor	file	name	jsp-api	High
Vendor	Manifest	tstamp	1302	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	jar	package name	jsp	Highest
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	today	April 3 2020	Low
Product	jar	package name	jsp	Low
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	servlet	Highest
Product	Manifest	dstamp	20200403	Low
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	file	name	jsp-api	High
Product	Manifest	tstamp	1302	Low
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	jar	package name	jsp	Highest
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\servlet-api.jar
MD5: e8cb45f4fd586ef9d9f7e1279179bdd9
SHA1: cf699993addfade33a37c447b3fe29dd39737890
SHA256:c6b42c4e8ca302000e292fadc395b0c207855b1927d854d5399d3edfd03b4655
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	today	April 3 2020	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	file	name	servlet-api	High
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	Manifest	dstamp	20200403	Low
Product	Manifest	today	April 3 2020	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	servlet	Highest
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	dstamp	20200403	Low
Product	jar	package name	filter	Highest
Product	file	name	servlet-api	High
Product	Manifest	tstamp	1302	Low
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Low
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Version	jar	package name	filter	Highest
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-api.jar
MD5: 72604155cd828572c692b5cfdbd7d973
SHA1: 3525e7b61247c492b7a66634ebce73a4a10456eb
SHA256:195a7105352d1849f7cab4e3f1e3c913c3ab9d9b3e29bf92edcf9abe8080dbba
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	today	April 3 2020	Low
Vendor	jar	package name	apache	Highest
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	Manifest	dstamp	20200403	Low
Vendor	file	name	tomcat-api	High
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	jar	package name	tomcat	Low
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	today	April 3 2020	Low
Product	jar	package name	apache	Highest
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	specification-title	Apache Tomcat	Medium
Product	Manifest	dstamp	20200403	Low
Product	file	name	tomcat-api	High
Product	Manifest	tstamp	1302	Low
Product	jar	package name	tomcat	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	Manifest	Implementation-Version	9.0.34	High
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Related Dependencies

tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-util.jar
- MD5: c0f8b648f94a6ed7747d29fd884ffc68
- SHA1: 00e4717dd1597715e5ecd483e9dbd6fa3744a46b
- SHA256: 3d72c3a103184c9a96514830b3d8441228e14b4356b0f926839718a9a85c008b
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-dbcp.jar
- MD5: d6222289b062cad232de0a648cda2df3
- SHA1: d930fee3126e64442e4a0b5085b65d5cd3f5be58
- SHA256: d674377b87dcece8ee1087edfa2eb03a8705ece26a279af20f6130e45f68fecc
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-websocket.jar
- MD5: e5906d13011d20d65766f114fc630ba6
- SHA1: 8c4201dea5849abb10bf7722454590b5d5739d48
- SHA256: f6f5efdea7c3c8aede44888f424e1ca6545110d6882422214774332c5b3aa463
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-util-scan.jar
- MD5: afe849948623cdba628c938864414dd9
- SHA1: f356788535365483361e5f97ae058744be443289
- SHA256: 672ea483d0913a247b3dc96ea0583d55fdeffe74575a31533218b159ea3089d4
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-jni.jar
- MD5: 2b49e0378914fa54870b152a9f0f9a8d
- SHA1: 5616e268c634872572bbc4af2a1600fd77d5b8d1
- SHA256: 3b236178344dfb0a506487e267616c3885f012906f5154e43799500ac9d4616a
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-coyote.jar
- MD5: 5b8e0964ee4a39146eb5326b042a5075
- SHA1: 5f376d650769a99a0411091b968bf75965b04ccd
- SHA256: b7ce5e8171bdfdc12bb4032c0b4719ee7f144166ab344a9a0eab897a6b47e7c1

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-cs.jar
MD5: 3720a3c5facfccd13a51731aeb627575
SHA1: a60cac71ce3f27a8e66a4e348b16c4ef903c8362
SHA256:9748e9b5cd9d06b0f2d38aae7a5f4626c709b874b5261f6a18d980e8867075d8
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	version	18	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	Manifest	Implementation-Version	9.0.34	High

Related Dependencies

tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-ja.jar
- MD5: 79f7f142aac50c3be480a1e080f7d6d5
- SHA1: 0d2b3058cdc8cb386ef4e36e2faaa5663c7168ed
- SHA256: 09f73f5241a70f4f7f91419c438bef6a6c140611cdef16909c6c152bf9142cbc
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-ko.jar
- MD5: efb82e54bfc0adf49ca3009092749d7d
- SHA1: 28bf259394648b723f69f10d457e3645bb5a769c
- SHA256: c4dd92a398fd027dbc86d266077c2b2fbab3ca8f86408da3e52a1f690fad4bf3
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-ru.jar
- MD5: e997bf9ba6ecb2d985a68a6a5055abd1
- SHA1: a7b98ef453dc814cbe11d61d24d43bf86ab1f021
- SHA256: 90910115ce290bd0538182fb791c3caad065599446ded57fa13f4ec3142ca000
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-zh-CN.jar
- MD5: 53f1e9ccda6460c318b14d5a74f19f03
- SHA1: f52f0fc2620ec86850daa525fe58896b1bf6ea7c
- SHA256: f0946b38dd7453070936220c59b52c9a5dec143258663472aa75315a28480ecc
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-es.jar
- MD5: 2c8767dd42e386b79058dfbde513f8fd
- SHA1: d604dde061c248b6fab7ac0665e35cdd613ecc99
- SHA256: 07bbec7d18a9eee14e4507f760f1d95ef4fd53738ca6938a96f9d9d9d921f17c
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-pt-BR.jar
- MD5: 5eea40be1f3e76cde50979a5dba8a68d
- SHA1: 2393529d2e92b3a1b52c5b73004d82e1465fae9d
- SHA256: bbdc6cda94bf737e9de5b1f85a362768693835935dae22a518b59c9246700a73
tomcat-9.0.34.tar.gz: tomcat-9.0.34.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-de.jar
- MD5: 06c88e2504372fd18d6e7024804d7cf2
- SHA1: 3095eb27c1e6d75c2d66a78f52d772b107e50682
- SHA256: 57de1359bbaf6f95a22fd9713deaf57a6081d3b546c2d19f4896a1ce508d7cb6

Identifiers

cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-i18n-fr.jar
MD5: 76f362e98eb3fbd7469c9043eb755fe1
SHA1: 81899c98a4dc189eb5a63cd77de1726e917eb236
SHA256:de78dbacb5b3da31fd1f2a2e1495cc7b3e7eeb7cd32aaeb8d30df575d23e8901
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	version	18	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	Manifest	Implementation-Version	9.0.34	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\tomcat-jdbc.jar
MD5: d5f85fe8a689ed92efa6bec3d70f68c3
SHA1: 79b6fcd8b73a592a96b9e42ced087fea5a795383
SHA256:a5a7e074912312f58b6680ece78e22c46dceac9cfc2fdaee89942ccb31fcc109
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	jar	package name	jdbc	Low
Vendor	jar	package name	jdbc	Highest
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat.jdbc	Medium
Vendor	jar	package name	apache	Low
Vendor	file	name	tomcat-jdbc	High
Vendor	jar	package name	tomcat	Highest
Product	jar	package name	jdbc	Low
Product	jar	package name	jdbc	Highest
Product	Manifest	Bundle-Name	Apache Tomcat JDBC Connection Pool	Medium
Product	jar	package name	apache	Highest
Product	jar	package name	pool	Low
Product	jar	package name	tomcat	Low
Product	Manifest	bundle-symbolicname	org.apache.tomcat.jdbc	Medium
Product	file	name	tomcat-jdbc	High
Product	jar	package name	tomcat	Highest
Product	jar	package name	pool	Highest
Version	Manifest	Bundle-Version	9.0.34	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Highest)

Published Vulnerabilities

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CWE-19 Data Processing Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

BID - 96293
CONFIRM - https://bugs.debian.org/851304
CONFIRM - https://bz.apache.org/bugzilla/show_bug.cgi?id=60578
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00038.html
CONFIRM - https://lists.debian.org/debian-security-announce/2017/msg00039.html
CONFIRM - https://security.netapp.com/advisory/ntap-20180731-0002/
DEBIAN - DSA-3787
DEBIAN - DSA-3788
REDHAT - RHSA-2017:0517
REDHAT - RHSA-2017:0826
REDHAT - RHSA-2017:0827
REDHAT - RHSA-2017:0828
REDHAT - RHSA-2017:0829
SECTRACK - 1037860

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.34\tomcat-9.0.34.tar.gz\tomcat-9.0.34.tar\apache-tomcat-9.0.34\lib\websocket-api.jar
MD5: da38f4d24cf8a1edf982b5b0a51805a5
SHA1: 64931306c5c2ae070d70cb330ed5a6e96566c3c7
SHA256:e15a96abd7bed144556db104596e3868441ac62ef6f1c40113263ac803861dc6
Referenced In Project/Scope:tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	today	April 3 2020	Low
Vendor	jar	package name	websocket	Highest
Vendor	file	name	websocket-api	High
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	tstamp	1302	Low
Vendor	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Low
Vendor	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Vendor	Manifest	dstamp	20200403	Low
Product	Manifest	today	April 3 2020	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	originally-created-by	1.8.0_242-b08 ()	Low
Product	jar	package name	websocket	Low
Product	Manifest	dstamp	20200403	Low
Product	jar	package name	websocket	Highest
Product	file	name	websocket-api	High
Product	Manifest	tstamp	1302	Low
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"	Low
Version	Manifest	today	2020	Low
Version	Manifest	tstamp	1302	Low
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	Manifest	dstamp	20200403	Low
Version	Manifest	Bundle-Version	9.0.34	High
Version	Manifest	today	3	Low

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_software_foundation:tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.34:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1548
BUGTRAQ - 20000721 Jakarta-tomcat.../admin
XF - jakarta-tomcat-admin(5160)

Vulnerable Software & Versions: (show all)

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 1532
BUGTRAQ - 20000719 [LoWNOISE] Snoop Servlet (Tomcat 3.1 and 3.0)

Vulnerable Software & Versions: (show all)

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20000322 Security bug in Apache project: Jakarta Tomcat
XF - apache-tomcat-file-contents(4205)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BUGTRAQ - 20010403 Re: Tomcat may reveal script source code by URL trickery
HP - HPSBTL0112-004
OSVDB - 5580
XF - jakarta-tomcat-jsp-source(6971)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 5786
BUGTRAQ - 20020924 JSP source code exposure in Tomcat 4.x
DEBIAN - DSA-170
HP - HPSBUX0212-229
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2002:217
REDHAT - RHSA-2002:218
XF - tomcat-servlet-source-code(10175)

Vulnerable Software & Versions: (show all)

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 4575
BUGTRAQ - 20020422 Tomcat real path disclosure (2)
CONFIRM - http://tomcat.apache.org/security-4.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
SECUNIA - 30899
SECUNIA - 30908
SUNALERT - 239312
VUPEN - ADV-2008-1979
XF - tomcat-example-class-information(8932)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6721
BUGTRAQ - 20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
SECUNIA - 7972
SECUNIA - 7977
XF - tomcat-null-directory-listing(11194)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 6722
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
XF - tomcat-webxml-read-files(11195)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 6720
CIAC - N-060
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
CONFIRM - http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
DEBIAN - DSA-246
HP - HPSBUX0303-249
OSVDB - 9203
OSVDB - 9204
SECUNIA - 7972
XF - tomcat-web-app-xss(11196)

Vulnerable Software & Versions: (show all)

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 12795
CERT-VN - VU#204710
CONFIRM - http://www.hitachi-support.com/security_e/vuls_e/HS05-006_e/index-e.html
CONFIRM - http://www.kb.cert.org/vuls/id/JGEI-6A2LEF
XF - tomcat-manager-ajp12-dos(19681)

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
FULLDISC - 20070906 Apache Tomcat remote xss
MISC - http://www.oliverkarow.de/research/jakarta556_xss.txt
MLIST - [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 12721
OSVDB - 34878
OSVDB - 34879
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1012793
SECUNIA - 13737
SECUNIA - 31493
XF - tomcat-functions-xss(36467)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 25531
BUGTRAQ - 20070904 Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20070905 Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34888
REDHAT - RHSA-2008:0261
SECUNIA - 29242
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2007-1729
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2007-07-31
BID - 24524
BID - 25159
BUGTRAQ - 20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://docs.info.apple.com/article.html?artnum=306172
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
JVN - JVN#16535199
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 34881
OVAL - oval:org.mitre.oval:def:10679
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018269
SECUNIA - 25721
SECUNIA - 26235
SECUNIA - 26660
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 30899
SECUNIA - 30908
SECUNIA - 31493
SECUNIA - 33668
SUNALERT - 239312
VUPEN - ADV-2007-1729
VUPEN - ADV-2007-2732
VUPEN - ADV-2007-3087
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1979
VUPEN - ADV-2009-0233

Vulnerable Software & Versions: (show all)

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

APPLE - APPLE-SA-2008-06-30
BID - 24476
BUGTRAQ - 20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://support.apple.com/kb/HT2163
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
CONFIRM - http://tomcat.apache.org/security-4.html
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
FEDORA - FEDORA-2007-3456
HP - SSRT071447
MANDRIVA - MDKSA-2007:241
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
OSVDB - 36080
OVAL - oval:org.mitre.oval:def:10578
REDHAT - RHSA-2007:0569
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECTRACK - 1018245
SECUNIA - 26076
SECUNIA - 27037
SECUNIA - 27727
SECUNIA - 29392
SECUNIA - 30802
SECUNIA - 31493
SECUNIA - 33668
SREASON - 2804
SUSE - SUSE-SR:2008:007
SUSE - SUSE-SR:2009:004
VUPEN - ADV-2007-2213
VUPEN - ADV-2007-3386
VUPEN - ADV-2008-1981
VUPEN - ADV-2009-0233
XF - tomcat-example-xss(34869)

Vulnerable Software & Versions: (show all)

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

BID - 27365
BUGTRAQ - 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities
BUGTRAQ - 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)
CONFIRM - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
CONFIRM - http://issues.apache.org/bugzilla/show_bug.cgi?id=41217
CONFIRM - http://security-tracker.debian.net/tracker/CVE-2008-0128
CONFIRM - http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
DEBIAN - DSA-1468
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2008:0261
REDHAT - RHSA-2008:0630
SECUNIA - 28549
SECUNIA - 28552
SECUNIA - 29242
SECUNIA - 31493
SECUNIA - 33668
SUSE - SUSE-SR:2008:005
VUPEN - ADV-2008-0192
VUPEN - ADV-2009-0233
XF - apache-singlesignon-information-disclosure(39804)

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=616717
REDHAT - RHSA-2010:0580
SECUNIA - 40813
VUPEN - ADV-2010-1986

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

BID - 36954
BUGTRAQ - 20091109 [SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password
BUGTRAQ - 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
CONFIRM - http://tomcat.apache.org/security-5.html
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2011-0003.html
CONFIRM - http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
HP - HPSBMA02535
HP - HPSBOV02762
HP - HPSBST02955
HP - HPSBUX02541
HP - HPSBUX02860
MISC - http://markmail.org/thread/wfu4nff5chvkb6xp
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20191124 [CONF] Apache Tomcat > Security
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
OVAL - oval:org.mitre.oval:def:19414
OVAL - oval:org.mitre.oval:def:7033
SECTRACK - 1023146
SECUNIA - 40330
SECUNIA - 57126
VUPEN - ADV-2009-3185
VUPEN - ADV-2010-1559
XF - tomcat-admin-default-password(54182)

Vulnerable Software & Versions: (show all)

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 56686
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=880011
MISC - http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
MLIST - [oss-security] 20121125 Re: CVE Request: slowloris for tomcat
MLIST - [users] 20090619 How does Tomcat handle a slow HTTP DoS?
MLIST - [users] 20090620 Re: How does Tomcat handle a slow HTTP DoS?
SUSE - openSUSE-SU-2012:1700
SUSE - openSUSE-SU-2012:1701
SUSE - openSUSE-SU-2013:0147
XF - apache-tomcat-slowloris-dos(80317)

Vulnerable Software & Versions: (show all)

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

MLIST - [oss-security] 20130905 Re: CVE-2013-2185 / Tomcat
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
REDHAT - RHSA-2013:1193
REDHAT - RHSA-2013:1194
REDHAT - RHSA-2013:1265

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65773
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521829
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521854
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1552565
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069921
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0343
REDHAT - RHSA-2014:0344
REDHAT - RHSA-2014:0345
REDHAT - RHSA-2014:0686
SECUNIA - 57675
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59733
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

BID - 65767
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521834
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1521864
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549522
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549523
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1556540
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678113
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069905
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2014:0686
SECUNIA - 59036
SECUNIA - 59675
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873
UBUNTU - USN-2130-1

Vulnerable Software & Versions: (show all)

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

BID - 69728
BUGTRAQ - 20140910 CVE-2013-4444 Remote Code Execution in Apache Tomcat
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
HP - HPSBOV03503
MLIST - [oss-security] 20141024 Re: Duplicate Request: CVE-2013-4444 as a duplicate of CVE-2013-2185
SECTRACK - 1030834

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Information Exposure

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 65768
CONFIRM - http://advisories.mageia.org/MGASA-2014-0148.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549528
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1549529
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1558828
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21667883
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675886
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677147
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1069911
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
HP - HPSBOV03503
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
SECUNIA - 59036
SECUNIA - 59722
SECUNIA - 59724
SECUNIA - 59873

Vulnerable Software & Versions: (show all)

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

MISC - http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt

Vulnerable Software & Versions: (show all)

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

BID - 67671
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578337
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578341
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1579262
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67667
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578610
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578611
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578637
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578655
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1585853
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.novell.com/support/kb/doc.php?id=7010166
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] CVE-2014-0096 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030301
SECUNIA - 59121
SECUNIA - 59616
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729

Vulnerable Software & Versions: (show all)

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:N

References:

BID - 67668
BUGTRAQ - 20140527 Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
BUGTRAQ - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://linux.oracle.com/errata/ELSA-2014-0865.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578812
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1578814
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1580473
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21680603
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3447
DEBIAN - DSA-3530
FEDORA - FEDORA-2015-2109
FULLDISC - 20140527 [SECURITY] Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure
FULLDISC - 20140527 [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
HP - HPSBUX03150
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030302
SECUNIA - 59121
SECUNIA - 59678
SECUNIA - 59732
SECUNIA - 59835
SECUNIA - 59849
SECUNIA - 59873
SECUNIA - 60729
SECUNIA - 60793

Vulnerable Software & Versions: (show all)

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

BID - 67669
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0268.html
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588193
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1588199
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589640
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589837
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589980
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589983
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589985
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589990
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589992
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1589997
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590028
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1590036
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593815
CONFIRM - http://svn.apache.org/viewvc?view=revision&revision=1593821
CONFIRM - http://tomcat.apache.org/security-6.html
CONFIRM - http://tomcat.apache.org/security-7.html
CONFIRM - http://tomcat.apache.org/security-8.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21678231
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21681528
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
DEBIAN - DSA-3530
DEBIAN - DSA-3552
FULLDISC - 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
HP - HPSBOV03503
HP - HPSBUX03102
MANDRIVA - MDVSA-2015:052
MANDRIVA - MDVSA-2015:053
MANDRIVA - MDVSA-2015:084
MLIST - [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
MLIST - [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
MLIST - [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
MLIST - [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0720
REDHAT - RHSA-2015:0765
SECTRACK - 1030298
SECUNIA - 59732
SECUNIA - 59873
SECUNIA - 60729
UBUNTU - USN-2654-1

Vulnerable Software & Versions: (show all)

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*